
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
A javascript self-interpreter with a focus on sandboxed execution and runtime introspection.
At the most basic level, esper's eval function can be used as a safe replacement for the native eval function.
var four = esper.eval('2+2');
More functionality is available via an Engine object.
var engine = esper({
});
engine.addGlobal('two', 2);
engine.load('2+two');
var result = engine.runSync();
result.toNative() === 4;
The esper()
function takes an options object as it only parameter.
strict
Type: boolean
Default: false
If true, force all code to be run in strict mode.
foreignObjectMode
Type: string
Default: link
addInternalStack
Type: boolean
Default: false
If true, the interpreter's internal stack will be added to the stack trace of exceptions.
executionLimit
Type: Integer
Default: Infinity
The number of AST nodes methods like .runSync()
will evaluate before giving up. Set this
to prevent infinite loops.
exposeEsperGlobal
Type: boolean
Default: true
Creates a global named Esper
inside the interpreter with introspection and metaprogramming functions.
Esper utilizes the webpack build system to create a single file suitable for use in the browser.
--env.profile=<profile>
Profile | Use |
---|---|
web | The default profile. Creates an single ES5 compatible file with self contained regenerator-runtime and es6 polyfills. |
modern | Creates an single ES6 compatible file. More performance than web, but requires a modern browser. |
nashorn | Crates a single file targeting the Java Nashorn engine. Uses Nashorn's parser instead of embedded esprima. |
--env.test
Creates a test builds that embeds the unit tests. Including this file in a <script>
tag will take over the page and
display the test output in real time.
--env.min
Minify the resulting build using UglifyJS.
If you'd like to contribute, please sign the CodeCombat contributor license agreement so we can accept your pull requests.
Checklist for contributing:
npm run test
npm run style
npm run cover
webpack --test
build passes test in browser.Cross-browser Testing Platform and Open Source <3 Provided by Sauce Labs
FAQs
Esper javascript interperter.
We found that esper.js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.